search for: vhost_vq_access_ok

...noczi <stefanha at redhat.com> --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039671b7..f6af4210679a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1246,7 +1246,7 @@ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { int ret = vq_log_access_ok(vq, vq->log_base); - if (ret || vq->iotlb) + if (!ret || vq->iotlb) return ret; return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); -- 2.14.3

...noczi <stefanha at redhat.com> --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039671b7..f6af4210679a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1246,7 +1246,7 @@ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { int ret = vq_log_access_ok(vq, vq->log_base); - if (ret || vq->iotlb) + if (!ret || vq->iotlb) return ret; return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); -- 2.14.3

On Mon, Apr 9, 2018 at 6:10 AM, Stefan Hajnoczi <stefanha at redhat.com> wrote: > @@ -1246,7 +1246,7 @@ int vhost_vq_access_ok(struct vhost_virtqueue *vq) > { > int ret = vq_log_access_ok(vq, vq->log_base); > > - if (ret || vq->iotlb) > + if (!ret || vq->iotlb) > return ret; That logic is still very non-obvious. This code already had one bug because of an od...

...>> * [Linus] >> >> The first patch fixes the vhost virtqueue access check which was >> recently >> broken. The second patch replaces the int return type with bool to >> prevent >> future bugs. >> >> Stefan Hajnoczi (2): >> vhost: fix vhost_vq_access_ok() log check >> vhost: return bool from *_access_ok() functions >> >> drivers/vhost/vhost.h | 4 +-- >> drivers/vhost/vhost.c | 70 >> ++++++++++++++++++++++++++------------------------- >> 2 files changed, 38 insertions(+), 36 deletions(-) >> >...

...eck clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost: return bool from *_access_ok() functions drivers/vhost/vhost.h | 4 +-- drivers/vhost/vhost.c | 70 ++++++++++++++++++++++++++------------------------- 2 files changed, 38 insertions(+), 36 deletions(-) -- 2.14.3

...eck clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost: return bool from *_access_ok() functions drivers/vhost/vhost.h | 4 +-- drivers/vhost/vhost.c | 70 ++++++++++++++++++++++++++------------------------- 2 files changed, 38 insertions(+), 36 deletions(-) -- 2.14.3

...eck clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost: return bool from *_access_ok() functions drivers/vhost/vhost.h | 4 +-- drivers/vhost/vhost.c | 70 ++++++++++++++++++++++++++------------------------- 2 files changed, 38 insertions(+), 36 deletions(-) -- 2.14.3

...eck clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost: return bool from *_access_ok() functions drivers/vhost/vhost.h | 4 +-- drivers/vhost/vhost.c | 70 ++++++++++++++++++++++++++------------------------- 2 files changed, 38 insertions(+), 36 deletions(-) -- 2.14.3

...host/vhost.c b/drivers/vhost/vhost.c > index 5320039671b7..93fd0c75b0d8 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1244,10 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, > /* Caller should have vq mutex and device mutex */ > int vhost_vq_access_ok(struct vhost_virtqueue *vq) > { > - int ret = vq_log_access_ok(vq, vq->log_base); > + if (!vq_log_access_ok(vq, vq->log_base)) > + return 0; > > - if (ret || vq->iotlb) > - return ret; > + /* Access validation occurs at prefetch time with IOTLB */ > + if (vq...

.... Tsirkin <mst at redhat.com> --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039671b7..f6af4210679a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1246,7 +1246,7 @@ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { int ret = vq_log_access_ok(vq, vq->log_base); - if (ret || vq->iotlb) + if (!ret || vq->iotlb) return ret; return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); -- 2.14.3

...ons(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039671b7..93fd0c75b0d8 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1244,10 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, /* Caller should have vq mutex and device mutex */ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { - int ret = vq_log_access_ok(vq, vq->log_base); + if (!vq_log_access_ok(vq, vq->log_base)) + return 0; - if (ret || vq->iotlb) - return ret; + /* Access validation occurs at prefetch time with IOTLB */ + if (vq->iotlb) + return 1; return vq_access...

...2 to make the return type consistent and harder to misuse [Linus] > > The first patch fixes the vhost virtqueue access check which was recently > broken. The second patch replaces the int return type with bool to prevent > future bugs. > > Stefan Hajnoczi (2): > vhost: fix vhost_vq_access_ok() log check > vhost: return bool from *_access_ok() functions > > drivers/vhost/vhost.h | 4 +-- > drivers/vhost/vhost.c | 70 ++++++++++++++++++++++++++------------------------- > 2 files changed, 38 insertions(+), 36 deletions(-) > Acked-by: Jason Wang <jasowang at r...

...ons(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index bec722e41f58..fc805b7fad9d 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1244,10 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, /* Caller should have vq mutex and device mutex */ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { - int ret = vq_log_access_ok(vq, vq->log_base); + if (!vq_log_access_ok(vq, vq->log_base)) + return 0; - if (ret || vq->iotlb) - return ret; + /* Access validation occurs at prefetch time with IOTLB */ + if (vq->iotlb) + return 1; return vq_access...

...fixes the vhost virtqueue access check which was recently > broken. The second patch replaces the int return type with bool to prevent > future bugs. Acked-by: Michael S. Tsirkin <mst at redhat.com> We need the 1st one on stable I think. > Stefan Hajnoczi (2): > vhost: fix vhost_vq_access_ok() log check > vhost: return bool from *_access_ok() functions > > drivers/vhost/vhost.h | 4 +-- > drivers/vhost/vhost.c | 70 ++++++++++++++++++++++++++------------------------- > 2 files changed, 38 insertions(+), 36 deletions(-) > > -- > 2.14.3

..., 8 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5d5a9d9..5320039 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1244,14 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, /* Caller should have vq mutex and device mutex */ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { - if (vq->iotlb) { - /* When device IOTLB was used, the access validation - * will be validated during prefetching. - */ - return 1; - } - return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used) && - vq_log_access_ok(vq, vq->lo...

..., 8 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5d5a9d9..5320039 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1244,14 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, /* Caller should have vq mutex and device mutex */ int vhost_vq_access_ok(struct vhost_virtqueue *vq) { - if (vq->iotlb) { - /* When device IOTLB was used, the access validation - * will be validated during prefetching. - */ - return 1; - } - return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used) && - vq_log_access_ok(vq, vq->lo...

....h +++ b/drivers/vhost/vhost.h @@ -178,8 +178,8 @@ void vhost_dev_cleanup(struct vhost_dev *); void vhost_dev_stop(struct vhost_dev *); long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, void __user *argp); long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp); -int vhost_vq_access_ok(struct vhost_virtqueue *vq); -int vhost_log_access_ok(struct vhost_dev *); +bool vhost_vq_access_ok(struct vhost_virtqueue *vq); +bool vhost_log_access_ok(struct vhost_dev *); int vhost_get_vq_desc(struct vhost_virtqueue *, struct iovec iov[], unsigned int iov_count, diff --git a/driver...

...drivers/vhost/vhost.h @@ -178,8 +178,8 @@ void vhost_dev_cleanup(struct vhost_dev *); void vhost_dev_stop(struct vhost_dev *); long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, void __user *argp); long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp); -int vhost_vq_access_ok(struct vhost_virtqueue *vq); -int vhost_log_access_ok(struct vhost_dev *); +bool vhost_vq_access_ok(struct vhost_virtqueue *vq); +bool vhost_log_access_ok(struct vhost_dev *); int vhost_get_vq_desc(struct vhost_virtqueue *, struct iovec iov[], unsigned int iov_count, diff --git a/driver...

...an re-queue themselves. */ vhost_test_flush(n); + kfree(n->dev.vqs); kfree(n); return 0; } @@ -179,14 +192,14 @@ static long vhost_test_run(struct vhost_test *n, int test) for (index = 0; index < n->dev.nvqs; ++index) { /* Verify that ring has been setup correctly. */ - if (!vhost_vq_access_ok(&n->vqs[index])) { + if (!vhost_vq_access_ok(&n->vqs[index].vq)) { r = -EFAULT; goto err; } } for (index = 0; index < n->dev.nvqs; ++index) { - vq = n->vqs + index; + vq = &n->vqs[index].vq; mutex_lock(&vq->mutex); priv = test ? n : NUL...

...an re-queue themselves. */ vhost_test_flush(n); + kfree(n->dev.vqs); kfree(n); return 0; } @@ -179,14 +192,14 @@ static long vhost_test_run(struct vhost_test *n, int test) for (index = 0; index < n->dev.nvqs; ++index) { /* Verify that ring has been setup correctly. */ - if (!vhost_vq_access_ok(&n->vqs[index])) { + if (!vhost_vq_access_ok(&n->vqs[index].vq)) { r = -EFAULT; goto err; } } for (index = 0; index < n->dev.nvqs; ++index) { - vq = n->vqs + index; + vq = &n->vqs[index].vq; mutex_lock(&vq->mutex); priv = test ? n : NUL...